Assign user role based on LDAP group

[giesselmann]

Hi,
I wanted to suggest another feature which might become handy having cc in a larger organization:
Is it possible or could we implement a way, to derive a cc user-role from LDAP groups?

For example default to 'user' for all, but have employees automatically as 'support' role members.

Cheers,
Pay

[moebiusband73]

Could you make a suggestion how this is specified in ldap. Would it be sufficient to add a fields that contains the information together with a map which group maps to which role?

[giesselmann]

I have to read up on LDAP a bit, I have no idea how this looks under the hood.
So far just a could be nice to have enhancement issue.

[moebiusband73]

You may want to have a look at the ldap sync routine

cc-backend/internal/auth/ldap.go

Line 103 in d0516f1

func (la *LdapAuthenticator) Sync() error {

The problem is that ldap directories might use different attributes. E.g. we use the gecos attribute for the Real name of the user. Not sure if this is filled in all the time.
In general you have to know which attribute of the user entry you want to map, and then provide a map in the ldap configuration to specify which value you want to map to which role. Unmapped entries fall back to user role.